Detection of Thermal Covert Channel Attacks Based on Classification of Components of the Thermal Signal Features

In response to growing security challenges facing many-core systems imposed by thermal covert channel (TCC) attacks, a number of threshold-based detection methods have been proposed. In this paper, we show that these threshold-based detection methods are inadequate to detect TCCs that harness advanced signaling and specific modulation techniques. Since the frequency representation of a TCC signal is found to have multiple side lobes, this important feature shall be explored to enhance the TCC detection capability. To this end, we present a pattern-classification-based TCC detection method using an artificial neural network that is trained with a large volume of spectrum traces of TCC signals. After proper training, this classifier is applied at runtime to infer TCCs, should they exist. The proposed detection method is able to achieve a detection accuracy of 99%, even in the presence of the stealthiest TCCs ever discovered. Because of its low runtime overhead (<inline-formula><tex-math notation="LaTeX">$&lt; 0.187\%$</tex-math><alternatives><mml:math><mml:mrow><mml:mo>&lt;</mml:mo><mml:mn>0</mml:mn><mml:mo>.</mml:mo><mml:mn>187</mml:mn><mml:mo>%</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq1-3189578.gif"/></alternatives></inline-formula>) and low energy overhead (<inline-formula><tex-math notation="LaTeX">$&lt; 0.072\%$</tex-math><alternatives><mml:math><mml:mrow><mml:mo>&lt;</mml:mo><mml:mn>0</mml:mn><mml:mo>.</mml:mo><mml:mn>072</mml:mn><mml:mo>%</mml:mo></mml:mrow></mml:math><inline-graphic xlink:href="wang-ieq2-3189578.gif"/></alternatives></inline-formula>), this proposed detection method can be indispensable in fighting against TCC attacks in many-core systems. With such a high accuracy in detecting TCCs, powerful countermeasures, like the ones based on dynamic voltage and frequency scaling (DVFS), can be rightfully applied to neutralize any malicious core participating in a TCC attack.